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REMARKS 

This application has been carefully reviewed in light of the Office Action mailed 
December 22, 2004. Claims 1-51 are pending in the application. Claims 1,21 and 39 have 
been amended. Claims 50 and 51 have been allowed and Claims 52-56 have been added. 
Applicants respectfully request reconsideration and favorable action of all pending claims in 
view of the following remarks. 

Rejections Under 35 U.S.C. § 103 

Claims 1-16, 18, 19, 21-37, 39-43, 45, and 47-49 are rejected under 35 U.S.C. § 
103(a) as being unpatentable over U.S. Patent 5,850,516 to Schneier ("Schneier") in view of 
U.S. Patent 5,991,881 to Conklin et al. ("Conklin"). Applicants respectfully traverse these 
rejections for the reasons discussed below. 

Claim 1, as amended, recites "storing data representative of network activity in 
datasets, the datasets including root datasets each having a root keyset and child datasets each 
having a child keyset with a key combination being a subset of, and less granular than, a 
root keyset," but the cited references do not teach this limitation. Rather, the portion of 
Schneier relied on in the Office Action involves an attack tree in which a goal node has 
associated child nodes in which it is necessary to accomplish activities associated with the 
child nodes to achieve the goal of the goal node. See Fig. 3, Column 6, lines 25-66. This 
does not teach a key combination of a child keyset being a subset of, and less granular 
than, a root keyset, however. Clearly, Schneier does not involve a subset relationship. For 
example, "pick lock 303" of Figure 3 is not a subset of "open safe 301," even though "pick 
lock 303" may be one way to achieve the goal of "open safe," nor is "pick lock" less granular 
that "open safe." In contrast, according to one embodiment described in Applicants' 
specification, the keyset "AxBx" is a subset of "AaBb" and is less granular. See page 16, 
lines 3-9. Conklin was used in the Office Action primarily to teach the use of keysets, but 
does not overcome the above-described deficiency in the proposed combination, as it also 
fails to disclose this limitation. For at least this reason, Claim 1 is allowable, as are the 
claims depending therefrom. Independent Claims 21 and 39 are allowable for analogous 
reasons, as are the claims depending therefrom. Favorable action is requested. 
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Allowable Subject Matter 

Applicants appreciate the statement in the Office Action at Page 7 that Claims 50 and 
51 are allowable and that Claims 17, 20, 38, 44, and 46 would be allowable if rewritten in 
independent form. Applicants have rewritten Claims 17, 20, 38, 44, and 46 in independent 
form as new Claims 52-56. Favorable action is requested. 
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Conclusion 

Applicants have made an earnest attempt to place this case in condition for allowance. 
For at least the foregoing reasons, Applicants respectfully request full allowance of all 
pending claims. 

If the Examiner believes that a telephone conference would advance prosecution of 
this Application in any manner, the Examiner is invited to contact the undersigned Attorney 
for Applicants at the Examiner's convenience. 

Applicants enclose a check in the amount of $1,200.00 for adding five (5) new claims. 
However, the Commissioner is hereby authorized to charge any additional fees or credit any 
overpayments to Deposit Account No. 02-0384 of Baker Botts L.L.P. 



BAKER BOTTS L.L.P. 




Date: January 24, 2005 
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